Extracted

• • Target

    46fc9c3f0b2cb404b5d2f55e76886763_JaffaCakes118

  • Size

    215KB

  • MD5

    46fc9c3f0b2cb404b5d2f55e76886763

  • SHA1

    55dad8f50b2b17271623bb3f3923c1e963a26d91

  • SHA256

    5c05c7b7bace103ed8af779d5f383ca53eb5ce84fa9430ed2c95b8050915c23d

  • SHA512

    2a116940b6882654ac5d2c33e0a00078a96673c7b53883f1e9887835153ad11e28439d27ac535a3fb9ab2e395c7ada081744e2455601b47c1164a72395906d12

  • SSDEEP

    3072:FzAKb/OW+OTwgkNZ0UMKRovRrHTyxL/zZy9TNz+E4Gm4Rq13bnPoMbLwAyS8c/je:Fv/OW+OT6f+rHTyxJFE4GmJ/D+Oqz0Cz

  Score

  10^/10

  salitybackdoorevasionpersistenceprivilege_escalationtrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Deletes itself

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2